NSE4 Firewall Policies and NAT Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create a VIP for HTTP mapping port 80 to 10.0.0.1

  Why this is correct

  A Virtual IP (VIP) in FortiOS is the standard object for destination NAT, translating an incoming public IP:port pair to a private destination. By mapping the external address's TCP port 80 to 10.0.0.1:80, the administrator configures the DNAT rule that redirects inbound HTTP traffic to the first internal server. This VIP must then be referenced in a firewall policy that allows the traffic and performs the translation.

• ✗

  Create an IP pool for the public IP

  Why it's wrong here

  IP pools in FortiOS are used exclusively for source NAT (SNAT) — selecting a translated source address for outbound sessions or for NATing traffic leaving an interface. They do not inspect or alter the destination IP or port of inbound packets, so creating an IP pool for the public IP would have no effect on inbound HTTP/HTTPS port forwarding. Destination NAT requires a VIP object combined with a firewall policy, never an IP pool.

• ✓

  Create a VIP for HTTPS mapping port 443 to 10.0.0.2

  Why this is correct

  A second VIP is required for the HTTPS service because each VIP object binds a specific external port to a different internal destination; in this case, port 443 must be translated to 10.0.0.2 while port 80 goes to 10.0.0.1. Since the public IP is shared, the destination port disambiguates which internal server should receive the connection. Without a separate VIP, traffic destined to 10.0.0.2:443 would not be translated correctly.

• ✗

  Configure policy-based routing for each server

  Why it's wrong here

  Policy-based routing (PBR) steers packets based on source/destination addresses, interfaces, or other criteria, affecting the next-hop routing decision; it does not perform any address translation. Destination NAT is accomplished by the VIP object and by firewall policies that reference it, with translation occurring before routing. Even if multiple servers require different paths, adding PBR rules would not create the required port mappings and would not replace DNAT.

• ✗

  Use Central SNAT with port forwarding

  Why it's wrong here

  Central SNAT is a global NAT setting that centralizes source NAT configuration, translating source addresses of sessions — typically for outbound traffic — and does not handle inbound port forwarding or destination address replacement. Applying 'port forwarding' through Central SNAT would be a misuse of the feature because forwarding or DNAT is the function of a Virtual IP. If Central NAT is enabled, DNAT is still configured with VIP objects; Central SNAT policies only affect the source field of translated packets.

Go deeper

Related to this question